Abstract:Log data are generated from logging statements in the source code, providing insights into the execution processes of software applications and systems. State-of-the-art log-based anomaly detection approaches typically leverage deep learning models to capture the semantic or sequential information in the log data and detect anomalous runtime behaviors. However, the impacts of these different types of information are not clear. In addition, existing approaches have not captured the timestamps in the log data, which can potentially provide more fine-grained temporal information than sequential information. In this work, we propose a configurable transformer-based anomaly detection model that can capture the semantic, sequential, and temporal information in the log data and allows us to configure the different types of information as the model's features. Additionally, we train and evaluate the proposed model using log sequences of different lengths, thus overcoming the constraint of existing methods that rely on fixed-length or time-windowed log sequences as inputs. With the proposed model, we conduct a series of experiments with different combinations of input features to evaluate the roles of different types of information in anomaly detection. When presented with log sequences of varying lengths, the model can attain competitive and consistently stable performance compared to the baselines. The results indicate that the event occurrence information plays a key role in identifying anomalies, while the impact of the sequential and temporal information is not significant for anomaly detection in the studied public datasets. On the other hand, the findings also reveal the simplicity of the studied public datasets and highlight the importance of constructing new datasets that contain different types of anomalies to better evaluate the performance of anomaly detection models.

CausalConvLSTM: Semi-Supervised Log Anomaly Detection Through Sequence Modeling

Anomaly Detection Model for Log Based on LSTM Network and Variational Autoencoder

An Anomaly Detection Approach of Part-of-Speech Log Sequence Via Population Based Training

MLog: Mogrifier LSTM-based Log Anomaly Detection Approach Using Semantic Representation

Unsupervised and Semi-supervised Anomaly Detection with LSTM Neural Networks

A LSTM-Based Anomaly Detection Model for Log Analysis

ConAnomaly: Content-Based Anomaly Detection for System Logs

Attention Based CNN-LSTM Network for Anomaly Pattern Classification of Multivariate Time Series

Log anomaly detection method based on CNN and LSTM fusion

Log Sequence Anomaly Detection Based on Local Information Extraction and Globally Sparse Transformer Model

An Enhancing Timeseries Anomaly Detection Using LSTM and Bi-LSTM Architectures

Log-based Anomaly Detection Without Log Parsing

SSDLog: a semi-supervised dual branch model for log anomaly detection

LSTM-based Anomaly Detection for Non-linear Dynamical System

LogPS: A Robust Log Sequential Anomaly Detection Approach Based on Natural Language Processing

Natural Language Processing-based Model for Log Anomaly Detection

ETCNLog: A System Log Anomaly Detection Method Based on Efficient Channel Attention and Temporal Convolutional Network

LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs

CNN and LSTM based Encoder-Decoder for Anomaly Detection in Multivariate Time Series

What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach

Log Sequence Anomaly Detection Method Based on Contrastive Adversarial Training and Dual Feature Extraction